ManageEngine ADSelfService Plus. Evaluator s Guide

Transcription

1 ManageEngine ADSelfService Plus Evaluator s Guide

2 Table of Contents Document Summary:...3 ADSelfService Plus Overview:...3 Core Features & Benefits:...4 ADSelfService Plus Architecture:...5 Admin Portal:... 6 Domain User Portal:... 7 Password Reset/Account Unlock:... 8 Password Self-service:...9 Task 1 - Configure Self-service Policies... 9 Task 2 - Set up Identity Verification Task 3 Enroll Users Task 4 Perform Password Self-service Password/Account Expiry Notifier: Employee Directory Update and Search: Change Password: Security Center General Configuration Settings for ADSelfService Plus Support: Appendix: P a g e

3 Document Summary: The purpose of this document is to introduce you to ADSelfService Plus, its functionality, and features. In doing so, the document helps you to evaluate the product better, know how to put different features to use, and figure out the best way to use this product in your environment. In this document, you ll find: Description about the core features Introduction and usage of various supporting features Product preparation flows Basic/Common configuration needed to run the product ADSelfService Plus Overview: In an Active Directory environment, managing users passwords take precedence over many other tasks because of the security risks involved in password theft. To ensure better security, IT administrators enforce strong password and account lockout policies that often result in forgotten passwords and account lockouts. The result is additional helpdesk calls and a fall in employee productivity. ADSelfService Plus is a secure, web-based, self-service Windows Active Directory Password Reset management program. It reduces the burden on helpdesk personnel and administrators by doing the following: Equips end-users with self-service password management Allows employees to self-update their contact information in Active Directory Allows employees to search for their colleagues contact information Provides comprehensive audit reports on all user activities 3 P a g e

4 Core Features & Benefits: Feature What does it offer? Password Self-Service Allows employees to o o o Reset Password Unlock Account Change Password Secure SMS/ based two factor authentication for ID verification Password Reset/Account Unlock can be performed over the internet via a web browser or right from the Winlogon (Ctrl+Alt+Del) prompt After successful password self-service, the changes can be automatically synchronized across multiple platforms like AS400 and UX servers Password Expiry Notification Send automatic password expiry notification Schedule multiple notifications at specific intervals Account expiry notification is also supported Employee Directory Update Allows employees to update their contact information, photos, profile details and other information in Active Directory Customizable self-update layout to control what information can be updated by employees Custom attributes to update organization specific information Employee Search and Organization Chart Allows employees to search for their colleagues information Search for 3 types of AD objects - Users, Contacts and Groups Customizable search criteria View employee relations flowchart 4 P a g e

5 ADSelfService Plus Architecture: Fig 1: ADSelfService Plus Architecture 5 P a g e

6 Admin Portal: The admin portal of ADSelfService Plus allows administrators to configure Domain settings, Self-Service Policies and product customization. Domain Settings: When ADSelfService Plus is run for the first time, it will automatically add the domains that it can discover on your organization s network. You can also manually add domains using the Domain Settings link provided on the top left corner of the web portal. Self-Service Policy Configuration: A self-service policy is automatically created for each and every domain added to ADSelfService Plus. The policies are used to define what set of self-service features can be accessed by the users belonging to a particular domain/ou. Administrators can create and edit self-service policies by selecting a set of features and assigning them to domain/ous. It is possible to have more than one self-service policy applied to a domain provided that the policy does not overlap on any of the OUs in that domain. 6 P a g e

7 Domain User Portal: Users can log in to the domain user portal to enroll with ADSelfService Plus, self-update their profile information, and change their passwords. Enrollment: Enrollment is the process by which users register themselves with ADSelfService Plus for Identity Verification during password reset/account unlock process. The procedure involves the users answering a set of Security Question(s) and Answer(s) and/or entering their Mobile number and/or id as chosen by the administrator. Self-Update and Employee Search: Users can update their contact information and profile details including photos under Self- Update tab of domain user portal. They can also search for their colleagues information using the employee search box provided at the top right corner of the domain user portal. Change Password: Users can change their soon-to-expire password under Change password tab of the domain user portal. 7 P a g e

8 Password Reset/Account Unlock: Users can reset their passwords and unlock their accounts by clicking on the Reset Password/Unlock Account link either from the login screen of ADSelfService Plus or from the Windows logon screen of their machines. Via Web Browser: When ADSelfService Plus is deployed over the internet and LAN, users can access Reset Password/Unlock Account link through a simple web browser by entering the URL of ADSelfService Plus server. For E.g.: Via Winlogon (CTRL+ALT+DEL) screen: To access Reset Password/Unlock Account link from the Windows logon screen, ADSelfService Plus comes bundled with a Client Software. It is an extension of Microsoft GINA/Credential Provider, which places a Reset Password/Unlock Account link on the Windows logon screen of users machines when installed. How users identities are verified during password reset? Users trying to reset their passwords/unlock their accounts will be asked to prove their identity with the information they used to enroll with ADSelfService Plus. Only after successful ID verification, users will be allowed to reset their passwords/unlock their accounts. 8 P a g e

9 Password Self-service: This section will guide you through the process of setting up password self-service for endusers and the steps involved in reset password/unlock account actions. Task 1 - Configure Self-service Policies Log into ADSelfService Plus as an administrator and go to Configuration Self Service Policy Configuration Click Add New Policy Select Reset Password, Unlock Account and Change password features Click Select OUs and select a Domain, and then the OUs. Click Save Policy Once you have created a new policy, click Advanced to configure advanced settings of the policy to tighten security and automate self-service actions. Following settings can be configured under Advanced Configuration: Block User Q&A Settings Notification General Settings Reset/Unlock Enrollment Automation 9 P a g e

10 Task 2 - Set up Identity Verification Go to Configuration Self Service Security Que & Ans Choose a policy and select the Identity Verification method. You can enable either Security Que & Ans or Verification code or both. Under Security Que & Ans tab, you can configure Question Settings, Answer Settings, and also Edit (Add, Modify, Delete, Set as Mandatory) the questions. Under Verification Code tab, you can select the communication medium ( or Mobile) through which the users will receive verification code, and also customize the message that will be sent to the user Note: When Verification Code is enabled, make sure that you configure Mail and SMS server settings under Admin Product Settings Server Settings. 10 P a g e

11 Task 3 Enroll Users Before users can use Password Self-service functions, they must enroll themselves with ADSelfService Plus. You can notify and force users to enroll with ADSelfService Plus. Go to Configuration Administrative Tools Quick Enrollment. Use any of the following options to enroll users with ADSelfService Plus: Auto Enrollment: Import Security Que(s) & Ans(s) from a CSV file and enroll users without their intervention. Enrollment Notification: Send a notification to users asking them to enroll with ADSelfService Plus. Enrollment Reminders: When enabled, the product automatically searches for nonenrolled users and associates their account with a Logon Script, which prompts/forces users to enroll with ADSelfService Plus when they log into their system. 11 P a g e

12 Task 4 Perform Password Self-service Once the policies are configured and users are enrolled with ADSelfService Plus, selfservice operations like password reset/account unlock can be performed by the users. Following is the process involved in resetting a password or unlocking an account: Access the Self Service Portal: There are two ways through which users can perform Password Reset/Account Unlock. o Via Web Browser Access ADSelfService Plus web portal by entering ADSelfService Plus URL in the web browser. o Via Winlogon (CTRL+ALT+DEL) screen In the Windows Logon prompt of their computers, users can click Reset Password/Unlock Account link. 12 P a g e

13 Prove your Identity: Once the users click Reset Password/Unlock Account link they will be asked to enter their username and select their domain. Then they will have to prove their identity by answering the Security Que & Ans, or through the verification code sent to their or mobile, or both. Once the users successfully prove their identity, they will be allowed to reset their passwords or unlock their accounts. Reset Password/Unlock Account: After proving their identity, users can now reset their passwords or unlock their accounts using ADSelfService Plus. You can automatically notify users upon successful self-service operations. To enable Reset Password/Unlock Account notifications, go to Configuration Policy Configuration and select Advanced Settings of a policy. Under Notification tab, you can enable ADSelfService Plus to send automatic notifications upon Reset Password, Unlock Account and Change Password operations. Tips: 1) The password and account status changes will be updated in Active Directory as soon as the self-service operation is completed. If you have many Domain Controllers and want to update certain DCs before others, then you can use Site Based DC tool available under Admin System Utilities Site Based DC. 2) ADSelfService Plus also has the facility to synchronize password across multiple systems like IBM AS400 and HP UX. To enable Password Synchronizer, go to Configuration Administrative Tools Password Synchronizer and configure the desired systems. 13 P a g e

14 Password/Account Expiry Notifier: You can set up password/account expiry notifications to be delivered automatically to a user when his password/account is about to expire. Go to Configuration Self-service Password Expiry Notification Enter all the required details such as notification type, notification frequency and time and days of delivery Click Save Send multiple reminders at specific intervals You can send multiple reminders to users at specific intervals to make sure that users are reminded periodically of their password expiry. To send multiple reminders at specific intervals, change Notification Frequency to On Specific Days. 14 P a g e

15 Employee Directory Update and Search: To enable employees to self-update their contact information, do the following: Go to Configuration Self-Service Policy Configuration Edit a policy and select Self Update. Click Self Update Layout link and select a layout from the drop down menu. Click Save Policy. 15 P a g e

16 Self-Update Layout Using this tool, you can create a customized layout and choose what information can be updated by the employees. Go to Configuration Administrative Tools Self Update Layout You can either Create a New Layout or edit the existing Default Layout While customizing the layout you can simply drag and drop attributes in the layout space To allow employees to update their photos, select Enable employees to perform Photo Updation option Note: You can also create your own Custom Attributes apart from the existing list of General Attributes. To do so, select Custom Attributes from Attributes List drop down menu. Enter the required details and click Add. 16 P a g e

17 Enable Employee Search Go to Configuration Self-Service Employee Search Select Enable Employee Search option and choose the domains in which it will be active. You can also select the type of Objects (Users, Contacts and Groups) that users can search for, and search criteria used to narrow down the search. To enable Organization Chart: Go to Configuration Self-Service Employee Search More Options Select Enable Organization Chart option and click Save. 17 P a g e

18 Change Password: Users can change their Windows Active Directory password in ADSelfService Plus by following these simple steps: Log into ADSelfService Plus with Windows Active Directory username and password Click Change Password tab Enter the old password Now, enter the new password (refer the Domain Password Policy requirements displayed in that page) and confirm the same by entering it again. Click OK. 18 P a g e

19 Security Center Security is paramount when it comes to any application, especially the one that deals with users passwords. ADSelfService Plus has a robust set of security measures in place to make sure that any attack from outside the organization or inside of it is taken care of. The various security features of ADSelfService Plus are collected under one place called Security Center for easier access and management. To access Security Center, go to Configuration Security Center. The security settings available under Security Center are as follows: Password Strengtheners Security Que & Ans Strengtheners Anti-Hacking System Enable SSL: Enabling SSL will help secure the data transmitted between ADSelfService Plus server and users web browser over the internet. ADSelfService Plus has a built-in SSL Certification tool that will help you to generate a CSR file which can be used to obtain certificates from a Certification Authority. For more information, please refer SSL Certification Guide. 19 P a g e

20 General Configuration Settings for ADSelfService Plus Restrict Inactive Users Using this tool, you may restrict inactive users in Active Directory like account expired users, account disabled users, deleted users, etc., from accessing ADSelfService Plus and to free up any licenses assigned to them. To do so: Go to, Admin License Management Restrict Users Select a domain and its OUs You can either choose to restrict users manually or automatically Customize ADSelfService Plus: ADSelfService Plus can be customized and rebranded to suit your organization better. Rebranding Go to Admin Customize Rebranding. Here you can change the following settings: Logo Browser Title Theme Color Browser Title Image Font Family and Size Password Policy Message Note: Password Policy Message is the text message that appears on Reset Password/Unlock Account page to assist users in selecting a strong password. Personalization Go to Admin Customize Personalize. Here you can change the default ADSelfService Plus administrator password and the default time and date settings. 20 P a g e

21 Language Selection: ADSelfService Plus supports 15 languages including French, Spanish, German, Chinese and Arabic. You can change the default language of the application under Personalization. Go to Admin Customize Personalize Select your preferred language from the Choose Language drop down menu Setting the language to Browser Default will set the language to default browser language External Data Sources and Database Backup If you are already using an in-house database that contains the users Security Que & Ans data, then you can reuse that data in ADSelfService Plus by following the steps below: Go to Configuration Administrative Tools External Data Sources Click Add New Data Source Enter the required details and click Create to connect the external data source with ADSelfService Plus If you are using the built-in PostgreSQL database in ADSelfService Plus, then you can automatically back-up the data by scheduling Automatic DB Backup. Go to Admin System Utilities Automatic DB Backup Select the schedule for backup and the storage path where the backup files should be stored Click Save Settings. 21 P a g e

22 Super Admin and Operators You can delegate certain or all product administrative tasks to other users by declaring them as Technicians. A Technician has rights to configure various settings of ADSelfService Plus. To declare a user as a Technician: Go to Configuration Administrative Tools Technicians Click Add New Technician Select the domain, a user and the technician role Click Add There are two types of technician: Super Admin: A user designated as a Super Admin has full control over ADSelfService Plus and he can configure any settings in the application. Operator: A user designated as an Operator has only auditing capability and can configure the various ADSelfService Plus reports. 22 P a g e

23 Integration within your environment ADSelfService Plus can be integrated with the following applications: SharePoint Outlook Web Access The ADSelfService Plus Client Software can also be made to work with other 3rd party GINA/Credential Providers extensions. Click here for steps on how to configure ADSelfService Plus Client Software to work with your 3rd party GINA/Credential Provider extensions. To install ADSelfService Plus Client Software, please refer the following guides: Installation through ADSelfService Plus Web Portal and Manual Installation Installation through Group Policy Objects Support: For any queries or support, please visit ADSelfService Plus support page or contact us at 23 P a g e

24 Appendix: Related Documents & Articles: The table below lists documents and other useful resources that will help you to get things rolling with ADSelfService Plus. Document Name Admin Guide User Guide Client Software Installation via GPO and via Web Portal and Manually ADSelfService Plus Integration with OWA SSL Certification Guide Security Measures Guide More Documents Description Helps administrators to quickly setup ADSelfService Plus and to understand the various features of the software. Helps end-users to quickly learn about using ADSelfService Plus for self-service actions. Helps administrators to quickly deploy the ADSelfService Plus client software to users machines. Helps administrators to integrate ADSelfService Plus with various applications used in your environment. Helps administrators with securing ADSelfService Plus with SSL certification. Showcases all the security measures employed in ADSelfService Plus to ward off security threats. Please visit 24 P a g e